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Synopsis: Set lead for Legat to contact service providers to determine 

identity of individual using IP addresses. 


Administrati ve: 

Diego and SA l 


Reference telca ll between SSa[ 


| of San 

PENTTBOMB Team, FBIHQ, on 4/16/2002. 


Details: At approximately 3:45 p.m. on September 12, 2001, the 

Washington Field Office of the FBI was notified by the Dulles Airport 
Police that a suspicious vehicle was found at the Dulles International 
Airport located in the Hourly Lot, Row G, Dulles, Virginia. Department oi 
Motor Vehicle records were reviewed by FBI agents from the Washington 
Field Office and determined the 1988 Toyota Corolla, with California 
license plates. Vehicle Identification Number JT2AE92E9J3137546, was 
registered to Nawaf Al-Hazmi, of 8451 Mount Vernon Avenue, Lemon Grove, 
California. 


The vehicle was searched by agents of the FBI a nd found to _ 

CQiLhaa_a mpHiral_ixcescr ipt ion for Khalid Al-Mihdhar from l ~1 

_l California, a receipt for car service at 

_ San Diego, California, signed by Khalid Al- 

Mihdhar, and an insurance card under the name of Khalid Al-Mihdhar, 7091 
Eskstrom Avenue, San Diego, California. Subsequent investigation in San 
Diego confirmed that both Al-Hazmi and Al-Mihdhar resided in San Diego ir 
1999 and 2000. 
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To: Ottawa From: San Diego 

Re: 265A-NY-280350 , 04/11/2002 


On September 13, 2001, FBI agents from the San Diego Field 
Office interviewed flight instructors at the Sorbi Flight Club which is 
located at the Montgomery Airfield, San Diego, California. According to 
the flight instructors, in May of 2000, Al-Hazmi and Al-Mihdhar began 
taking flying lessons with the Sorbi Flight Club. Al-Hazmi and Al-Mihdhc 
expressed a strong interest in.flying Boeing and jet aircraft. Al-Hazmi 
and Al-Mihdhar were instructed that they would have to learn to fly 
smaller single engine aircraft first. Al-Hazmi and Al-Mihdhar took 
approximately six flying lessons at the Sorbi Flight Club. Al-Hazmi and 
Al-Mihdhar were mainly preoccupied with learning to control the aircraft 
while airborne and took no interest in takeoffs and landings and made 
little effort to improve those flying skills. 


On Septem ber 15, 2001, Special Agents of the FBI made contact 
with g person named 


5 = 


stated that he is a 
Arabia, and entered the United 


During an initial interview, 
citizen of Yemen, was raised in Sau 

States in 1998 on a student visa. 1 _| remained silent when asked 

if he knew Al-Hazmi and Al-Mihdar. He denied knowledge of the terrorist 
events of Se ptember 11, 2001. During sub sequent intery iews with 

admitted knowing A] 
at a local Mosque 


] on September 15 and 16, 2001, 


had met them 


Hazmi and Al-Mihdhar and advised that he 
approximatel y eighteen months ago and regularly prayed there with them. 

claimed that he regularly gave them English lessons and 


attempted to help them adjust to life in the United States. In Ju ly of 

2000, he moved into an apa-rl-mpnl- located _ 

California_recalled hhat Al-Hazmi and Al-Mihdhar were still 

listed on t he lease at that time but were preparing to move out. 

I _I said that in December 2000 he moved into a residence located 

at l l after Al-Hazmi and 

Al-Mihdhar moved out of the residence. 


On September 15, 2001, 


granted Special Agents of 


the FBI consent to searc h his room and his home computer at the 

I The San Diego Regional Computer Forensics 


Laboratory ("R CFL") subsequently performed a forensic analysis of 

computer. The RCFL uncovered several web pages on the 


computer's hard drive which expressed strong anti-American sentiments. 
These web pages contained headlines such as "America's Campaign to Destrc 
Islam," "U.S. & Britian Kill Muslim Children In Genocide Attempt," and "l 
Message From Bin Laadin[sic]: Declaration of War." There were also severs 
web pages in support of the Mu slims and their war against the Russians ir 


Chechnya. Digital records from 
address MOHDAR78@HOTMAIL.COM. 


computer revealed the email 


Investigation at Grossmont-Cuyamaca Community College District, 
8800 Grossmont College Drive, El Cajon, California by the FBI revealed 
that the email address, MOHDAR78@HOTMAIL.COM, was provided by Mohdar 
Abdullah as a point of contact. 
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To: Ottawa From: San Diego 

Re: 265A-NY-280350 , 04/11/2002 
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On September 19, 2001, Special Agents from the FBI interviewed 
Mohdar M. Abdullah of 1415 E. Lexington Avenue, Apartment Number 146, El 
Cajon, California regarding his association with Al-Hazmi and Al-Mihdhar. 
Abdullah related that he met Al-Hazmi and Al-Mihdhar in 1999 in San Diegc 
California, Omar Al-Bayoumi asked Abdullah to become acquainted with Al- 
Hazmi and Al-Mihdhar and to acclimate them the area and assist in any via\ 
in their affairs. Abdullah assisted Al-Hazmi and Al-Mihdhar in arranging 
travel arrangements and flight lessons while in San Diego, California. Ir 
early 2001, Al-Hazmi telephonically contacted Abdullah and informed him 
that Al-Hazmi was in Arizona attending flight school. 


On September 21, 2001, a Federal material witness warrant, 
pursuant to Title 18, United States Code, Section 3144, was issued in the 
Southern District of New York for Abdullah's detention. On September 21, 
2001, Abdullah was arrested as a material witness in San Diego, Californj 
and transferred to New York on September 25, 2001. 


On October 5, 2001, Abdullah was interviewed by Agents of the 
FBI in conjunction with a Grand Jury investigation in the Southern 
District of New York. Abdullah was shown and acknowledged writing a 
document that contained references to Stinger anti-tank weapons, 
"martyrs," "mortors,", and "grenade launchers." Abdullah further explains 
that the document reflected his interest in weapo nry, which was spawned 
through his relationship with an individual named I 


Abdullah advised that he and 
shooting range in El Cajon, California.'! 


had utilized an indoor 


of 


Abdullah and attended the A1 Ribat mo sque in the San Diego area. Abdulla] - 
also knew | | and stated that he was a veteran of 
the Unitea States Navy. 


Subsequent investigation with rhp TTrnt-^rl states Navy has 


revealed that an individual named 


was previously enlisted 


in the Navy and had received small arms weapons training. 


On September 22, 
Federal search warrant at 
Subsequent to the search, 
address, | 


2001. Special Agents of the FBI executed a 


a computer was identified by a resident of the 
] as having been used frequently by Abdullah. 


A separate 
computer, which was 
this computer was an 


Federal search warrant was acquired for this 
then forensically reviewed by the RCFL. Lo cated on 
email message da ted August 12, 2001, from | | 


AL1AKUM FROM KANSAS CITY 

said "PLEASE 


with the subject line "SALAAM U 
URGENT RESPONSE NEEDED.." In the message, 


COLEN POWELL STATED 
TO JERUSELEM WE MUST 
PRESS COVERAGE." The 


TALK TO THE BROTHERS IN SAN DIEGO AS MANY AS Y OU CAD 
TODAY THAT THE US WAS COMMITED TO MOVING THE EM BASS^i 
ORGANIZE A MASSIVE PROTEST OF THI S STANCE WE NEED 
message was sent td I Furth« 
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To: Ottawa From: San Diego 

Re: 265A-NY-280350 \, 04/11/2002 


investigation revealed that numerous individuals used the seized compute: 
to perform a myriad of functions, including checking email. 


Special Agent 


advised that based on discussion 


with agents working Domestic ana international Terrorism, the alleged 
terrorists involved in the attacks on the World Trade Center Towers and 
Pentagon collaborated and communicated with a network of individuals an$ 
organizations to facilitate their attacks. It is believed that they usee 
the Internet, including email accounts to communicate with associates. 


FBI analysis of the business records and email activity 
obtained in the investigation to date indicates that some of the 19 
suspected hijackers used the internet to further their criminal conduct. 
For example, at least 12 of the suspected hijackers purchased airline anc 
other tickets over the internet using email and giving email addresses as 
contact and confirmation points for their reservations. The tickets for 
the hijacked flights that were purchased using email addresses were all 
purchased between August 25 and August 29, 2001, further indicating that 
the hijackers had closely, and secretly, communicated to coordinate theii 
scheme. 


Uoon reviewina 

the contents ofl 

account, 

agents o£ one discovered 

01/18/2 OoT; troml 

| that 


MSN Hotmail 
an email dated 


statements relating to possible terrorist activities. The communication 
contained, in part, the following statements: 

"before, our plan was to go to the U.S, we would have a few 
people ready to plant bombs in very important buildings" 

The communication specifies as targets; the White House, NASA, the UN 
Headquarters and the Canadian Parliament Building, among others. It goes 
on to say that "All this sounds impossible, but anything is possible". 

The au thor finally directs th e recipients of the email to respond to the 
account |and tell him what they think of the plan. 


A 2703(d) 
relating to the account 
the account was accessed 


Court Order was served on MSN Hotmail for records 

The results showed that 
MSN Hotmail keej 


from a numoer or if addresses. 
a record of every login to a Hotmail account and what IP address was usee 
for that login. An IP address is a unique number assigned to each 
computer on the Internet. The physical equivalent would be a telephone 
number with country and area code. The subscriber records can be obtaine 
for an IP address just as with a telephone number. 


The following IP addresses were used to access the 
laccount at the times listed: 
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To: Ottawa From: San Diego 

Re: 265A-NY-280350 , 04/11/2002 


IP 


Time(Pacific) 


Date 
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To: Ottawa From: San Diego 

Re: 265A-NY-280350 , 04/11/2002 


SA l I queried a publicly accessible database for 

information n n Mip TP ^rlHrps sps used to access the Hotmail account. The 


address block 


is owned by: 


The address block of 


is owned by: 


■be 

b7C 


The above list points of contact can be contacted to determine 
the identity of the person using each IP address at the specified date ar 
time. 
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To: Ottawa From: San Diego 

Re: 265A-NY-280350 , 04/11/2002 


LEAD(s): 

Set Lead 1: 


OTTAWA 


AT OTTAWA 


Liaison with Canadian officials to have the following companie 
contacted to determine the identity of the individual who used the IP 
addresses at the specified dates and times: 


All IP addresses beginning with 


be 

b7C 


All IP addresses beginning with 


♦♦ 
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Links to Saudi Government: 


2. Education & Financial Support: On his application for admission to a doctoral program at 
Case Western Reserve University, Al-Bayoumi stated he was employed by the Saudi Civil Aviation 
Administration (CAA) for 20 years and was the "Assistant to the Director of Finance, Contracts and 
Finance Control Division, PCA, Airways Engineering" of Dallah/Aveo Trans Arabia Company 
(which is under contract to the CAA to provide aircraft operations maintenance). In 1995, Ercan 
Engineering, a San Diego subcontractor of Dallah/Avco, was asked by the CAA to provide financial 
support to Al-Bayoumi while he studied in the U.S. Ercan refused and was told its contract maybe 
jeopardized as a result. Al-Bayoumi told NSY that the CAA pays him $5,000 per month to study in 
England for his PhD. However, the Mabahith claims Al-Bayoumi is financing his own education. In 
a 1998 le tter to Case Western Reserve University, the Royal Embassy of Saudi Arabia, National 
Guard Office, WDC, claimed that Al-Bayoumi was a candidate for a full scholarship from the 
government of Saudi Arabia. 

3. Mailings: On 01/18/2001, Al-Bayoumi received a UPS package at his San Diego 
apartment from the Saudi Embassy in WDC. 















SE 




4. Witness Reports: Various SD witnesses have described AI-B ayoumi as "associated with 


the Saudi government" j |) ; "a frequent traveler to Saudi Arabia" ( 


"member of the 


m 

(S) 


Aviation Board fo r Saudi A rabia" r~ "having regular contact with the Saudi Arabian 

Consulate in LA" d | ; " making frequent trips to the Saudi Consulate during the six years he was 
known to live in San Diego" | }; "working for the Saudi government to watch the actions of 

Saudis in the U.S." 1 i , inquiring about the welfare of Saudi stude nts in Sa n Diego (_i; 

"on a scholarship and fi nanciall y supported by the Saudi government". d "having friends at the 

Saudi Consulate in LA" d t ; "a spy for the Saudi government" (hijacker Al-Hazmi as reported by 
Shaikh); "receiving support from the Saudi Arabian Government or Saudi Airlines" C3 a reputed 
"Saudi Arabian intelligence officer" due to his prolific vid eotaping of services at the mosque 
(Abukar); "an engineer for the Saudi Arabian government" CD ; providing a $500 checkto the SD 
Kurdish Community Islamic Center drawn on the account of the Royal Embassy of Saudi Arabia 
considere d by some in the community as "some type of intelligenc e agent for the Saudi 


Arabian govemmentC 


the Los Angeles airport to drap off or. pick up Saudis visiting southern California" 
to WDC every one to two months" to visit the civil aviation office of the Saudi Consulate on 


f freq uently trav eling to 
traveling 


(S } Street in WDC 


Wyoming 

" disclosing to others at the Islamic Center that he has friends/contacts in the 

a "ghost employee" ofDallah/Avco an d one of "ap proximately 50 


(S) 


Saudi Consulate in LA" 
individuals carried on the books of Dallah and being paid f ordoing nothing " 
Saudi Intelligence Service to report on dissident Saudis 


J "working for the 


(S) 


SEClR^T 


bl ' 
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